experimental-a2 0.19.0 → 0.21.1

package/examples/playground/app/a0/sandbox-log.ts

@@ -1,7 +1,7 @@
 import 'server-only'
 import { contract } from 'experimental-a2'
 import { vercelQueues } from 'experimental-a2/scheduler-vercel'
-import { createServer } from 'experimental-a2/server'
+import { consumer, createServer } from 'experimental-a2/server'
 import { z } from 'zod'
 import { store } from '@/lib/store'
 import { isAppId } from './apps'
@@ -31,24 +31,26 @@ export const sandboxScheduler =
     ? vercelQueues({ topic: 'a2-a0-sandboxes' })
     : undefined
 
+const deleteIdleSandbox = consumer({
+  contract: sandboxLog,
+  name: 'delete-idle-sandbox',
+  types: ['sandbox.idle.checked'],
+}).run(async ({ event }) => {
+  const { appId } = event.payload
+  // A prompt since the sandbox opened makes it a real app's, whichever
+  // harness's agent got it.
+  const reads = await Promise.all(
+    Object.values(agentServers).map((server) => server.session(appId).state()),
+  )
+  if (reads.every(({ state }) => state.messages.length === 0))
+    await deleteAppSandbox({ appId })
+})
+
 export const sandboxServer = createServer({
   ...(store ? { store } : {}),
   ...(sandboxScheduler ? { scheduler: sandboxScheduler } : {}),
   contract: sandboxLog,
-  handlers: {
-    'sandbox.idle.checked': async ({ event }) => {
-      const { appId } = event.payload
-      // A prompt since the sandbox opened makes it a real app's, whichever
-      // harness's agent got it.
-      const reads = await Promise.all(
-        Object.values(agentServers).map((server) =>
-          server.session(appId).state(),
-        ),
-      )
-      if (reads.every(({ state }) => state.messages.length === 0))
-        await deleteAppSandbox({ appId })
-    },
-  },
+  consumers: [deleteIdleSandbox],
 })
 
 /**

package/examples/playground/app/a0/server.ts

@@ -1,7 +1,7 @@
 import 'server-only'
 import { waitUntil } from '@vercel/functions'
 import { tool } from 'ai'
-import { handlerContext } from 'experimental-a2/ai'
+import { consumerContext } from 'experimental-a2/ai'
 import { fx } from 'experimental-a2/ai/fx'
 import { pi } from 'experimental-a2/ai/pi'
 import { agent } from 'experimental-a2/ai/server'
@@ -55,7 +55,7 @@ const tools = {
     execute: ({ path }) =>
       timed(async () =>
         previewUrl({
-          sandbox: await appSandbox({ appId: handlerContext().session.id }),
+          sandbox: await appSandbox({ appId: consumerContext().session.id }),
           path,
         }),
       ),
@@ -68,7 +68,7 @@ const tools = {
       timeoutSeconds: z.number().int().min(1).max(240).default(120),
     }),
     execute: ({ command, timeoutSeconds }) => {
-      const context = handlerContext()
+      const context = consumerContext()
       return timed(async () =>
         bash({
           sandbox: await appSandbox({ appId: context.session.id }),
@@ -190,7 +190,7 @@ export const listServer = createServer({
   contract: appList,
 })
 
-/** The dev tools' crash logs, one per app. They have no handlers. */
+/** The dev tools' crash logs, one per app. They have no consumers. */
 export const crashServer = createServer({
   ...(store ? { store } : {}),
   contract: crashLog,

package/examples/playground/app/a0/shell.tsx

@@ -106,7 +106,7 @@ export function A0Shell({
   const remove = async (target: App): Promise<void> => {
     if (
       !confirm(
-        `Delete ${target.name}? This deletes its sandbox, with everything the agent built in it.`,
+        `Delete ${target.name}? This deletes its conversation and its sandbox, with everything the agent built in it.`,
       )
     )
       return

package/examples/playground/app/a0/uploads/route.test.ts

@@ -0,0 +1,59 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { POST } from './route'
+
+const appId = crypto.randomUUID()
+
+beforeEach(() => {
+  vi.stubEnv('BLOB_READ_WRITE_TOKEN', 'vercel_blob_rw_teststore_secret')
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+})
+
+/** What the browser's `upload()` asks its `handleUploadUrl` for first. */
+const tokenRequest = (pathname: string, clientPayload: string | null) =>
+  POST(
+    new Request('http://test/a0/uploads', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        type: 'blob.generate-client-token',
+        payload: { pathname, clientPayload, multipart: false },
+      }),
+    }),
+  )
+
+/** The upload a client token allows, as Blob reads it from the token. */
+const allowed = (clientToken: string): unknown => {
+  const [, encoded] = /^vercel_blob_client_teststore_(.+)$/.exec(clientToken)!
+  const signed = Buffer.from(encoded!, 'base64').toString()
+  const payload = signed.slice(signed.indexOf('.') + 1)
+  return JSON.parse(Buffer.from(payload, 'base64').toString())
+}
+
+it("signs an upload into the app's own folder, without a request of its own", async () => {
+  const fetch = vi.spyOn(globalThis, 'fetch')
+  const response = await tokenRequest(`a0/${appId}/shot.png`, appId)
+  expect(response.status).toBe(200)
+  const body = (await response.json()) as { type: string; clientToken: string }
+  expect(body.type).toBe('blob.generate-client-token')
+  expect(allowed(body.clientToken)).toMatchObject({
+    pathname: `a0/${appId}/shot.png`,
+    addRandomSuffix: true,
+  })
+  expect(fetch).not.toHaveBeenCalled()
+})
+
+it.each([
+  ['another app', `a0/${crypto.randomUUID()}/shot.png`, appId],
+  ['no app', `a0/${appId}/shot.png`, null],
+  ['something other than an app', 'a0/list/shot.png', 'list'],
+])('refuses an upload for %s', async (_, pathname, clientPayload) => {
+  const response = await tokenRequest(pathname, clientPayload)
+  expect(response.status).toBe(400)
+  expect(await response.json()).toEqual({
+    error: "An attachment goes in its app's folder",
+  })
+})